The vulnerability CVE-2025-23818 affects the pyko More Link Modifier plugin (versions up to 1.0.3). It is a CSRF vulnerability that enables an attacker to cause Stored XSS by tricking an authenticated user into submitting a crafted request. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability can lead to Stored XSS, which may allow an attacker to execute arbitrary scripts in the context of the affected application. This can result in information disclosure, session hijacking, or other malicious actions impacting user data and application integrity. The CVSS score of 7.1 reflects a high severity impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or restricting access to the More Link Modifier plugin to reduce exposure. Monitor vendor communications for updates on patches or mitigations.